PT-2020-15767 · Fossil+2 · Fossil+2

Max Justicz · Published 2020-08-19 · Updated 2024-06-15 · CVE-2020-24614

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fossil versions prior to 2.10.2 Fossil versions 2.11.x prior to 2.11.2 Fossil versions 2.12.x prior to 2.12.1

Description The issue allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the repository.

Recommendations For versions prior to 2.10.2, update to version 2.10.2 or later. For versions 2.11.x prior to 2.11.2, update to version 2.11.2 or later. For versions 2.12.x prior to 2.12.1, update to version 2.12.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ALT-PU-2020-2612

ALT-PU-2020-2899

CVE-2020-24614

MGASA-2020-0354

OPENSUSE-SU-2020:1478-1

OPENSUSE-SU-2020_1478-1

OPENSUSE-SU-2021:1070-1

OPENSUSE-SU-2024:10764-1

Affected Products

Alt Linux

Fossil

Suse

References · 30

• https://fossil-scm.org/forum/info/a05ae3ce7760daf6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24614 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVZK4K7SFBQRCGCHS76HW2LTSEH2KSUM · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24614 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10764-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202011-04 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-24614 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARYF4YMYXCANXUDS3B3CA4JGUZNUJOJA · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0354.html · Security Note
• https://osv.dev/vulnerability/CVE-2020-24614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24614 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24614 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0354 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00065.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-24614 · Security Note